Slides and demo videos for the talk that @antitree.com and I gave at the last @shmoocon.bsky.social on entitled, " "A Commencement into Real #Kubernetes Security!" Demos include use of Mark's brand new tool, as well as of Peirates. www.canva.com/design/DAGZr... 1/9 - ThreadSky

neutrino.bsky.social • 38 days ago

Slides and demo videos for the talk that @antitree.com and I gave at the last @shmoocon.bsky.social on entitled, " "A Commencement into Real #Kubernetes Security!"

Demos include use of Mark's brand new tool, as well as of Peirates.

https://www.canva.com/design/DAGZrMSnRv4/ZGU-7Y15NvSHO0ivXNfU9w/view?utm_content=DAGZrMSnRv4&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1461623101

1/9

Comments

neutrino.bsky.social•38 days ago

We discussed perceived vs actual risks.

Physical world: we think terrorists & gun crime to be the greatest risks, but not really - think cancer & heart disease.

#Kubernetes: we think CVEs & container breakout sploits, but it's overpriv RBAC, priv ctrs & kubectl delete in the wrong cluster. 2/9

neutrino.bsky.social•38 days ago

@antitree.com used his newly-released tool, Seccomp-Diff, to show that custom seccomp filters can accidentally be more permissive than Docker's default seccomp profile.

https://github.com/antitree/seccomp-diff
3/9

neutrino.bsky.social•38 days ago

Seccomp will not make your container a sandbox. You might want to investigate gvisor, which became far more performant in January 2023:

https://cloud.google.com/blog/products/containers-kubernetes/gvisor-file-system-improvements-for-gke-and-serverless

4/9

neutrino.bsky.social•38 days ago

We showed a multi-step attack path demo, with a story based on the last #ShmooCon "commencement" theme.

"Exploring the University Data Science Cluster"

https://youtu.be/-uFGJzaZ7XI

5/9

neutrino.bsky.social•38 days ago

The attack path includes Peirates harvesting service account tokens from a compromised node and then trying kubectl commands as every token:

https://inguardians.com/peirates/

6/9

neutrino.bsky.social•38 days ago

We also demonstrated using #KubeHound from @datadoghq.com to discover multi-step attack paths:

7/9

rafaribe.com•38 days ago

Is the talk available on Youtube or similar platforms?

plamen.works•37 days ago

Wow, I Came Looking for Copper and I Found Gold

Comments

Posting Rules

Reply